da43c912ee3553be9d5880b8845653a441407737f01e7fc029a0d4900289362d

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13695e278df773031e475f54a3a88de2.exe
Size

174KB
MD5

13695e278df773031e475f54a3a88de2
SHA1

7a628c4e3ee90624475c3b986e542f3b07b62e21
SHA256

da43c912ee3553be9d5880b8845653a441407737f01e7fc029a0d4900289362d
SHA512

e291047c69fa4e7d51686e30f6b8a921faa7533ce97cd1257c57df64eb567785c6fa9b86cada7c392108340e299fd514a626c9d1fda4a519d506ffe96ae82ca6
SSDEEP

3072:EVUy6nFP8lutw01N6KVO4UMBfhRX82CU8nMNGXwQJv8iiG9XGXTawAXDXhG:EqyKkMBPpVluWN+Jv8iiG9GmE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4584	EXPL0RER.EXE
4052	EXPL0RER.EXE
1564	EXPL0RER.EXE
436	EXPL0RER.EXE
4988	EXPL0RER.EXE
4780	EXPL0RER.EXE
5036	EXPL0RER.EXE
180	EXPL0RER.EXE
1752	EXPL0RER.EXE
4240	EXPL0RER.EXE
3044	EXPL0RER.EXE
4004	EXPL0RER.EXE
4392	EXPL0RER.EXE
1908	EXPL0RER.EXE
1192	EXPL0RER.EXE
2676	EXPL0RER.EXE
4624	EXPL0RER.EXE
2656	EXPL0RER.EXE
2028	EXPL0RER.EXE
404	EXPL0RER.EXE
1232	EXPL0RER.EXE
1456	EXPL0RER.EXE
4412	EXPL0RER.EXE
4380	EXPL0RER.EXE
4844	EXPL0RER.EXE
1712	EXPL0RER.EXE
4744	EXPL0RER.EXE
1428	EXPL0RER.EXE
3988	EXPL0RER.EXE
1504	EXPL0RER.EXE
3880	EXPL0RER.EXE
1668	EXPL0RER.EXE
2196	EXPL0RER.EXE
4936	EXPL0RER.EXE
1948	EXPL0RER.EXE
2068	EXPL0RER.EXE
1148	EXPL0RER.EXE
3068	EXPL0RER.EXE
1516	EXPL0RER.EXE
3744	EXPL0RER.EXE
3992	EXPL0RER.EXE
4928	EXPL0RER.EXE
5188	EXPL0RER.EXE
5548	EXPL0RER.EXE
5632	EXPL0RER.EXE
5800	EXPL0RER.EXE
5972	EXPL0RER.EXE
2076	EXPL0RER.EXE
3760	EXPL0RER.EXE
3600	EXPL0RER.EXE
5560	EXPL0RER.EXE
3936	EXPL0RER.EXE
1452	EXPL0RER.EXE
5832	EXPL0RER.EXE
3104	EXPL0RER.EXE
3952	EXPL0RER.EXE
1988	EXPL0RER.EXE
4072	EXPL0RER.EXE
5728	EXPL0RER.EXE
5720	EXPL0RER.EXE
3348	EXPL0RER.EXE
764	EXPL0RER.EXE
5464	EXPL0RER.EXE
5628	EXPL0RER.EXE

Loads dropped DLL 64 IoCs

pid	Process
748	regsvr32.exe
4392	regsvr32.exe
764	regsvr32.exe
4976	regsvr32.exe
2436	regsvr32.exe
3400	regsvr32.exe
3400	regsvr32.exe
4244	regsvr32.exe
1896	regsvr32.exe
3992	regsvr32.exe
3992	regsvr32.exe
1856	regsvr32.exe
3108	regsvr32.exe
1184	regsvr32.exe
1184	regsvr32.exe
2428	regsvr32.exe
684	regsvr32.exe
684	regsvr32.exe
4928	regsvr32.exe
4928	regsvr32.exe
556	regsvr32.exe
1876	regsvr32.exe
1756	regsvr32.exe
3104	regsvr32.exe
3096	regsvr32.exe
4448	regsvr32.exe
4940	regsvr32.exe
4928	regsvr32.exe
4084	regsvr32.exe
3880	regsvr32.exe
3880	regsvr32.exe
4304	regsvr32.exe
4660	regsvr32.exe
1828	regsvr32.exe
4384	regsvr32.exe
4928	regsvr32.exe
3708	regsvr32.exe
4472	regsvr32.exe
2876	regsvr32.exe
1948	regsvr32.exe
1948	regsvr32.exe
5080	regsvr32.exe
5064	regsvr32.exe
3236	regsvr32.exe
3236	regsvr32.exe
1500	regsvr32.exe
1500	regsvr32.exe
1992	Conhost.exe
1992	Conhost.exe
5100	regsvr32.exe
5100	regsvr32.exe
2076	regsvr32.exe
5140	regsvr32.exe
5252	regsvr32.exe
5616	regsvr32.exe
5748	regsvr32.exe
5748	regsvr32.exe
5884	regsvr32.exe
6032	regsvr32.exe
5240	regsvr32.exe
5400	regsvr32.exe
4772	regsvr32.exe
5616	regsvr32.exe
2216	regsvr32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	13695e278df773031e475f54a3a88de2.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE

Program crash 10 IoCs

pid	pid_target	Process	procid_target
2068	1564	WerFault.exe	95
4244	4052	WerFault.exe	93
1884	180	WerFault.exe	105
1204	1516	WerFault.exe	214
1028	3744	WerFault.exe	216
3692	3992	WerFault.exe	218
2364	4928	WerFault.exe	222
5640	3068	WerFault.exe	343
7524	2704	WerFault.exe	357
6688	6156	WerFault.exe	423

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID\ = "SysModule64.classname"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID\ = "SysModule64.classname"	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID\ = "SysModule64.classname"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID\ = "SysModule64.classname"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 748	3460	13695e278df773031e475f54a3a88de2.exe	90
PID 3460 wrote to memory of 748	3460	13695e278df773031e475f54a3a88de2.exe	90
PID 3460 wrote to memory of 748	3460	13695e278df773031e475f54a3a88de2.exe	90
PID 3460 wrote to memory of 4584	3460	13695e278df773031e475f54a3a88de2.exe	91
PID 3460 wrote to memory of 4584	3460	13695e278df773031e475f54a3a88de2.exe	91
PID 3460 wrote to memory of 4584	3460	13695e278df773031e475f54a3a88de2.exe	91
PID 4584 wrote to memory of 4392	4584	EXPL0RER.EXE	92
PID 4584 wrote to memory of 4392	4584	EXPL0RER.EXE	92
PID 4584 wrote to memory of 4392	4584	EXPL0RER.EXE	92
PID 4584 wrote to memory of 4052	4584	EXPL0RER.EXE	93
PID 4584 wrote to memory of 4052	4584	EXPL0RER.EXE	93
PID 4584 wrote to memory of 4052	4584	EXPL0RER.EXE	93
PID 4052 wrote to memory of 764	4052	EXPL0RER.EXE	94
PID 4052 wrote to memory of 764	4052	EXPL0RER.EXE	94
PID 4052 wrote to memory of 764	4052	EXPL0RER.EXE	94
PID 4052 wrote to memory of 1564	4052	EXPL0RER.EXE	95
PID 4052 wrote to memory of 1564	4052	EXPL0RER.EXE	95
PID 4052 wrote to memory of 1564	4052	EXPL0RER.EXE	95
PID 1564 wrote to memory of 4976	1564	EXPL0RER.EXE	96
PID 1564 wrote to memory of 4976	1564	EXPL0RER.EXE	96
PID 1564 wrote to memory of 4976	1564	EXPL0RER.EXE	96
PID 1564 wrote to memory of 436	1564	EXPL0RER.EXE	97
PID 1564 wrote to memory of 436	1564	EXPL0RER.EXE	97
PID 1564 wrote to memory of 436	1564	EXPL0RER.EXE	97
PID 436 wrote to memory of 2436	436	EXPL0RER.EXE	98
PID 436 wrote to memory of 2436	436	EXPL0RER.EXE	98
PID 436 wrote to memory of 2436	436	EXPL0RER.EXE	98
PID 436 wrote to memory of 4988	436	EXPL0RER.EXE	99
PID 436 wrote to memory of 4988	436	EXPL0RER.EXE	99
PID 436 wrote to memory of 4988	436	EXPL0RER.EXE	99
PID 4988 wrote to memory of 3400	4988	EXPL0RER.EXE	100
PID 4988 wrote to memory of 3400	4988	EXPL0RER.EXE	100
PID 4988 wrote to memory of 3400	4988	EXPL0RER.EXE	100
PID 4988 wrote to memory of 4780	4988	EXPL0RER.EXE	101
PID 4988 wrote to memory of 4780	4988	EXPL0RER.EXE	101
PID 4988 wrote to memory of 4780	4988	EXPL0RER.EXE	101
PID 4780 wrote to memory of 4244	4780	EXPL0RER.EXE	102
PID 4780 wrote to memory of 4244	4780	EXPL0RER.EXE	102
PID 4780 wrote to memory of 4244	4780	EXPL0RER.EXE	102
PID 4780 wrote to memory of 5036	4780	EXPL0RER.EXE	103
PID 4780 wrote to memory of 5036	4780	EXPL0RER.EXE	103
PID 4780 wrote to memory of 5036	4780	EXPL0RER.EXE	103
PID 5036 wrote to memory of 1896	5036	EXPL0RER.EXE	104
PID 5036 wrote to memory of 1896	5036	EXPL0RER.EXE	104
PID 5036 wrote to memory of 1896	5036	EXPL0RER.EXE	104
PID 5036 wrote to memory of 180	5036	EXPL0RER.EXE	105
PID 5036 wrote to memory of 180	5036	EXPL0RER.EXE	105
PID 5036 wrote to memory of 180	5036	EXPL0RER.EXE	105
PID 180 wrote to memory of 3992	180	EXPL0RER.EXE	106
PID 180 wrote to memory of 3992	180	EXPL0RER.EXE	106
PID 180 wrote to memory of 3992	180	EXPL0RER.EXE	106
PID 180 wrote to memory of 1752	180	EXPL0RER.EXE	107
PID 180 wrote to memory of 1752	180	EXPL0RER.EXE	107
PID 180 wrote to memory of 1752	180	EXPL0RER.EXE	107
PID 1752 wrote to memory of 1856	1752	EXPL0RER.EXE	108
PID 1752 wrote to memory of 1856	1752	EXPL0RER.EXE	108
PID 1752 wrote to memory of 1856	1752	EXPL0RER.EXE	108
PID 1752 wrote to memory of 4240	1752	EXPL0RER.EXE	109
PID 1752 wrote to memory of 4240	1752	EXPL0RER.EXE	109
PID 1752 wrote to memory of 4240	1752	EXPL0RER.EXE	109
PID 4240 wrote to memory of 3108	4240	EXPL0RER.EXE	110
PID 4240 wrote to memory of 3108	4240	EXPL0RER.EXE	110
PID 4240 wrote to memory of 3108	4240	EXPL0RER.EXE	110
PID 4240 wrote to memory of 3044	4240	EXPL0RER.EXE	111

C:\Users\Admin\AppData\Local\Temp\13695e278df773031e475f54a3a88de2.exe
"C:\Users\Admin\AppData\Local\Temp\13695e278df773031e475f54a3a88de2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
  2⤵
  - Loads dropped DLL
  PID:748
- C:\Windows\SysWOW64\EXPL0RER.EXE
  C:\Windows\system32\EXPL0RER.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
    3⤵
    - Loads dropped DLL
    PID:4392
- - C:\Windows\SysWOW64\EXPL0RER.EXE
    C:\Windows\system32\EXPL0RER.EXE
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:764
  - - C:\Windows\SysWOW64\EXPL0RER.EXE
      C:\Windows\system32\EXPL0RER.EXE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1564
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4976
    - - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:436
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        6⤵
        Loads dropped DLL
        
        PID:2436
      - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        7⤵
        Loads dropped DLL
        
        PID:3400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        8⤵
        Loads dropped DLL
        
        PID:4244
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        9⤵
        Loads dropped DLL
        
        PID:1896
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:180
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        10⤵
        Loads dropped DLL
        
        PID:3992
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        11⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        12⤵
        Loads dropped DLL
        
        PID:3108
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3044
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        13⤵
        Loads dropped DLL
        
        PID:1184
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        13⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        14⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        14⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        15⤵
        Loads dropped DLL
        
        PID:684
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1908
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        16⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        16⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        17⤵
        Loads dropped DLL
        
        PID:556
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2676
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        18⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1876
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        18⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        19⤵
        Loads dropped DLL
        
        PID:1756
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        19⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        20⤵
        Loads dropped DLL
        
        PID:3104
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        20⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        21⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:404
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        22⤵
        Loads dropped DLL
        
        PID:4448
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        23⤵
        Loads dropped DLL
        
        PID:4940
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1456
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        24⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        24⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        25⤵
        Loads dropped DLL
        
        PID:4084
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        25⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        26⤵
        Loads dropped DLL
        
        PID:3880
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4844
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        27⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1712
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        28⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        28⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        29⤵
        Loads dropped DLL
        
        PID:1828
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        29⤵
        Executes dropped EXE
        
        PID:1428
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        30⤵
        Loads dropped DLL
        
        PID:4384
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        30⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3988
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        31⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1504
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        32⤵
        Loads dropped DLL
        
        PID:3708
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        33⤵
        Loads dropped DLL
        
        PID:4472
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1668
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        34⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2196
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        35⤵
        Loads dropped DLL
        
        PID:1948
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4936
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        36⤵
        Loads dropped DLL
        
        PID:5080
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1948
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        37⤵
        Loads dropped DLL
        
        PID:5064
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2068
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        38⤵
        Loads dropped DLL
        
        PID:3236
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        38⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        39⤵
        Loads dropped DLL
        
        PID:1500
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        40⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        41⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        41⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        42⤵
        Loads dropped DLL
        
        PID:5100
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        42⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        43⤵
        Loads dropped DLL
        
        PID:2076
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4928
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        44⤵
        Loads dropped DLL
        
        PID:5140
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        44⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5188
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        45⤵
        Loads dropped DLL
        
        PID:5252
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        45⤵
        Executes dropped EXE
        
        PID:5548
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        46⤵
        Loads dropped DLL
        
        PID:5616
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5632
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        47⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        47⤵
        Executes dropped EXE
        
        PID:5800
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        48⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        49⤵
        Loads dropped DLL
        
        PID:6032
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2076
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        50⤵
        Loads dropped DLL
        
        PID:5240
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        50⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3760
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        51⤵
        Loads dropped DLL
        
        PID:5400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        51⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        52⤵
        Loads dropped DLL
        
        PID:4772
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        52⤵
        Executes dropped EXE
        
        PID:5560
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        53⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        53⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        54⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1452
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        55⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        55⤵
        Executes dropped EXE
        
        PID:5832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        56⤵
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        56⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3104
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        57⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        57⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        58⤵
        
        PID:864
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        58⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1988
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        59⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4072
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        60⤵
        Modifies registry class
        
        PID:3564
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        61⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5720
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        62⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        62⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        63⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:764
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        64⤵
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        64⤵
        Executes dropped EXE
        
        PID:5464
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        65⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        66⤵
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        66⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        67⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        67⤵
        Drops file in System32 directory
        
        PID:2824
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        68⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        68⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5460
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        69⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        69⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        70⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        70⤵
        Drops file in Windows directory
        
        PID:5036
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        71⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        71⤵
        Drops file in Windows directory
        
        PID:2196
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        72⤵
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        72⤵
        Drops file in Windows directory
        
        PID:1756
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        73⤵
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        73⤵
        Drops file in System32 directory
        
        PID:2512
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        74⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        74⤵
        Drops file in System32 directory
        
        PID:4452
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        75⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        75⤵
        Drops file in Windows directory
        
        PID:4844
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        76⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        76⤵
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        77⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        77⤵
        Drops file in Windows directory
        
        PID:3068
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        78⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        78⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        79⤵
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        79⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6068
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        80⤵
        Modifies registry class
        
        PID:2644
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        80⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        81⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        81⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        82⤵
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        82⤵
        Drops file in Windows directory
        
        PID:3092
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        83⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        83⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        84⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        84⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        85⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        85⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        86⤵
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        86⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        87⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        87⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        88⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        88⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5568
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        89⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        89⤵
        Drops file in System32 directory
        
        PID:1988
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        90⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        90⤵
        Drops file in Windows directory
        
        PID:6224
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        91⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        91⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        92⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        92⤵
        Drops file in Windows directory
        
        PID:6448
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        93⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        93⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        94⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        94⤵
        Drops file in Windows directory
        
        PID:6680
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        95⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        95⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        96⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        96⤵
        Drops file in Windows directory
        
        PID:6884
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        97⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        97⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        98⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        98⤵
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        99⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        99⤵
        Drops file in Windows directory
        
        PID:6156
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        100⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        100⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        101⤵
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        101⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        102⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        102⤵
        Drops file in Windows directory
        
        PID:5932
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        103⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        103⤵
        Drops file in Windows directory
        
        PID:6776
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        104⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        104⤵
        Drops file in Windows directory
        
        PID:6860
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        105⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        105⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        106⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        106⤵
        Drops file in Windows directory
        
        PID:7148
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        107⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        107⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6252
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        108⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        108⤵
        Drops file in System32 directory
        
        PID:220
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        109⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        109⤵
        Drops file in Windows directory
        
        PID:6572
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        110⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        110⤵
        Drops file in Windows directory
        
        PID:1628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        111⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        111⤵
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        112⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        112⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        113⤵
        Modifies registry class
        
        PID:3268
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        113⤵
        Drops file in Windows directory
        
        PID:1484
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        114⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        114⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6592
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        115⤵
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        115⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3824
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        116⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        116⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        117⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        117⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        118⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        118⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        119⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        119⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        120⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        120⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        121⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        121⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        122⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        122⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        123⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        123⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        124⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        124⤵
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        125⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        125⤵
        Drops file in Windows directory
        
        PID:2112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        126⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        126⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        127⤵
        
        PID:184
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        127⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        128⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        128⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        129⤵
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        129⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        130⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        130⤵
        Drops file in Windows directory
        
        PID:7328
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        131⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        131⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        132⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        132⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:7624
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        133⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        133⤵
        Drops file in Windows directory
        
        PID:7736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        134⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        134⤵
        Drops file in Windows directory
        
        PID:7824
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        135⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        135⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        136⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        136⤵
        Drops file in System32 directory
        
        PID:8148
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        137⤵
        
        PID:464
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        137⤵
        Drops file in Windows directory
        
        PID:7292
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        138⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        138⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        139⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        139⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        140⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        140⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        141⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        141⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        142⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        142⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        143⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        143⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        144⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        144⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        145⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        145⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        146⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        146⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        147⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        147⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        148⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        148⤵
        
        PID:748
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        149⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        149⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        150⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        150⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        151⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        151⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        152⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        152⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        153⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        153⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        154⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        154⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        155⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        155⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        156⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        156⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        157⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        157⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        158⤵
        
        PID:400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        158⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        159⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        159⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        160⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        160⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        161⤵
        
        PID:400
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        161⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        162⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        162⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        163⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        163⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        164⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        164⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        165⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        165⤵
        
        PID:180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        108⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        107⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        106⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        105⤵
        
        PID:224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        104⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        103⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        102⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        101⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 444
        100⤵
        Program crash
        
        PID:6688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        99⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        98⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        97⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        96⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        95⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        94⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        93⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        92⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        91⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        90⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        89⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        88⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        87⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        86⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        85⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        84⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        83⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        82⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 444
        81⤵
        Program crash
        
        PID:7524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        80⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        79⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 408
        78⤵
        Program crash
        
        PID:5640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        77⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        76⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        75⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        74⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        73⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        72⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        71⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        70⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        69⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        68⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        67⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        66⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        65⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        64⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        63⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        62⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        61⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        60⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        59⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        58⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        57⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        56⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        55⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        54⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        53⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        52⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        51⤵
        
        PID:232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        50⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        49⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        48⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        47⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        46⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        45⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 444
        44⤵
        Program crash
        
        PID:2364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 456
        43⤵
        Program crash
        
        PID:3692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 416
        42⤵
        Program crash
        
        PID:1028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 424
        41⤵
        Program crash
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        40⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        39⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        38⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        37⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        36⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        35⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        34⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        33⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        32⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        31⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        30⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        29⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        28⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        27⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        26⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        25⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        24⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        23⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        22⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        21⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        20⤵
        
        PID:2428
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        21⤵
        Loads dropped DLL
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        19⤵
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        18⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        17⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        16⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        15⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        14⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        13⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        12⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        11⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 448
        10⤵
        Program crash
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        9⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        8⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        7⤵
        
        PID:3476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        6⤵
        
        PID:3576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 416
        5⤵
        Program crash
        
        PID:2068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 456
      4⤵
      Program crash
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
    3⤵
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1564 -ip 1564
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4052 -ip 4052
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 180 -ip 180
1⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1516 -ip 1516
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3744 -ip 3744
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3992 -ip 3992
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4928 -ip 4928
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3068 -ip 3068
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2704 -ip 2704
1⤵
PID:7488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6156 -ip 6156
1⤵
PID:6224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\$$336699.bat

Filesize
141B

MD5
e3efc16ca26ae31f9885ee9549ff1f82

SHA1
4321f47a61712ffbbad7a39691359474db4b947c

SHA256
a03f261cc17b929ef96c2faeef03b77af3b62ab84bbb73a79beb84878b1bfa61

SHA512
f376e9be088782e394d21958bcdb5e7f00605b05290eff1320d64d5a76bfa619c260c8b5d971e7015bb118f0dd13ad73033f76e55b717611bc1a7d876f8e62ab

Download Submit
C:\Windows\SysWOW64\EXPL0RER.EXE

Filesize
174KB

MD5
13695e278df773031e475f54a3a88de2

SHA1
7a628c4e3ee90624475c3b986e542f3b07b62e21

SHA256
da43c912ee3553be9d5880b8845653a441407737f01e7fc029a0d4900289362d

SHA512
e291047c69fa4e7d51686e30f6b8a921faa7533ce97cd1257c57df64eb567785c6fa9b86cada7c392108340e299fd514a626c9d1fda4a519d506ffe96ae82ca6

Download Submit
C:\Windows\SysWOW64\SysModule32.DLL

Filesize
49KB

MD5
80cdcab6c2947250e4e538a0a3fd9ad2

SHA1
b67acc78525e645ca5d81d35576f11b0475e274c

SHA256
b116a4659f14427e155a5bc7b14bfcaca866bb3817b6414b394bc3f7f077cd3e

SHA512
9b84d71bf516046bf78d27a02312ff5daeb8bf010bfbfdfbe729d539f9420bf0ffce1528de9e714878a14db5f5b9bb72ef1d6f92c0a40a6c88b1ac9b70dc0cd0

Download Submit
C:\Windows\SysWOW64\SysModule64.DLL

Filesize
65KB

MD5
ce0264955b0d93729cae5837ad4c4ad7

SHA1
8aa9b81e0285eb0c92c1e144716fa4337d578bc1

SHA256
b8832481e2a34ee6360653aaa3591fefcd002183f3487ce4f1cbe00056d5dbbc

SHA512
baca61d5b91ff09953c36f076dfb9f3d03eb5e9dbc13eab329e03439529c13b299fbcbe59a72b12ab369d332c598230fbd6897ce96f5696b088df5feb9eebc4d

Download Submit
C:\Windows\SysWOW64\SysModule64.DLL

Filesize
59KB

MD5
979f18ebe501198430204391c3b4e527

SHA1
5f294ad47e3648adad308bc1b6cec2b4ed31b1a6

SHA256
147ec40d4050c0d0a89097b91d6f24a9399893279adfd8d1fb277290e5e69d0a

SHA512
cb7e17a226ca85ffc9b296900c644def5a062bfecc4bf0a0f394e359e87e2c43ccbacae0ebb40c444fe633bb5294f1e0028a307cb0f8630944b12d46d6f686ef

Download Submit
C:\Windows\SysWOW64\SysModule64.DLL

Filesize
9KB

MD5
7f8e5488e4188f1aaa0b38047c831f51

SHA1
b70c1487efc0de56190cddac16ef6de194ae908e

SHA256
9bc75d2a92c5a8f466941ae630f23a1c2dad5052133f12173785334d6f3a2ec2

SHA512
f862dabc5f315a7cbaf821b708a0e12502854d065332d0c7a9e943c4b28e1ef7fe03f9724df2270295d5271a2dc9161b0cfa45bf19b49be3809df665f5a96acd

Download Submit
C:\Windows\SysWOW64\SysModule64.DLL

Filesize
353B

MD5
f78e86cabf7460b2da14ec0e7b13b7c5

SHA1
eb3097f4e51c9f32ab5872763992a6172de06aed

SHA256
eb9524e6286dd08f094699d508c30dc7e5e03f0db60500ce712501603ce466f0

SHA512
841bfd5c45d9fbee789341caf23ba3f26828a88df0a8ecfc51166d85d61892b78c9ddd7b439bf7d28767e8aaa3f1d11e4b8ebd3451d96b3977dab645e2478546

Download Submit
memory/180-475-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/180-241-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/404-419-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/436-377-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/436-215-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/684-219-0x0000000000780000-0x0000000000796000-memory.dmp

Filesize
88KB

Download
memory/1184-187-0x00000000008B0000-0x00000000008C6000-memory.dmp

Filesize
88KB

Download
memory/1192-345-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1232-420-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1456-421-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1564-214-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1752-242-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1908-339-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2028-387-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2656-386-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2676-384-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3044-244-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3044-468-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3400-92-0x0000000000820000-0x0000000000836000-memory.dmp

Filesize
88KB

Download
memory/3460-376-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3460-122-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3880-354-0x00000000006F0000-0x0000000000706000-memory.dmp

Filesize
88KB

Download
memory/3992-140-0x00000000006B0000-0x00000000006C6000-memory.dmp

Filesize
88KB

Download
memory/4004-245-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4004-478-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4052-357-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4052-213-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4240-243-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4240-461-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4380-423-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4392-294-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4392-482-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4412-422-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4584-378-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4584-201-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4624-385-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4780-383-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4780-217-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4928-230-0x0000000000BF0000-0x0000000000C06000-memory.dmp

Filesize
88KB

Download
memory/4988-374-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4988-216-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5036-426-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/5036-218-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download